Feeds

eBay pulls Vista laptop pwned in hacking contest

Do no harm

Beginner's guide to SSL certificates

An eBay listing for the Windows Vista laptop that was successfully compromised at last week's Pwn2Own hacking contest was removed after the online auctioneer said it violated terms that forbid sales of items that might do harm.

Shane Macaulay, who felled the machine with code that attacked a weakness in Adobe Flash, posted the listing late Monday night, California time. Within two hours, he said in an interview, he received an automated email that said the auction had been suspended.

According to this article by IDG News, the listing read: "This laptop is a good case study for any forensics group/company/individual that wants to prove how cool they are, and a live example, not canned of what a typical incident response sitchiation [sic] would look like."

"At least on the eBay item, I was being a little sensationalistic, but I was just trying to get a sale," he told El Reg. He said he didn't mean to break contest rules that forbid the disclosure of the flaw or exploit code prior to there being a patch.

"By the time they would have gotten it (the laptop), I'm positively sure it would be patched," he said. "The reason i didn't say that outright (was) i wanted to ... see what the market would pay for" the unpatched vulnerability.

Macaulay was one of two attendees to take a prize during last week's contest at the CanSecWest conference in Vancouver. Charlie Miller and two two other researchers from Independent Security Evaluators, won $10,000 for a previously unknown Safari browser exploit that brought down a fully patched MacBook Pro. Macaulay, who was aided by researcher Alex Sotirov, won $5,000 for their exploit. Winners were also permitted to keep the machines. A third laptop running Ubuntu remained standing.

The cash prize is paid by 3Com's Tipping Point division, whose Zero Day Initiative pays bounties to researchers who responsibly disclose vulnerabilities. One condition imposed on sellers is that they provide no details of the vulnerability.

A spokeswoman for eBay told IDG the wording of Macaulay's listing led them to think the laptop could do someone harm. ®

Intelligent flash storage arrays

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.